Since August 15, 2026, the Cybersecurity Act (Cbw) has also been in force in the Netherlands. More than 8.000 Dutch organizations will face registration obligations, duty of care, and reporting obligations. The Cybersecurity Act affects an estimated many hundreds of Dutch contact centers, as well as, indirectly, a range of BPO players and tech suppliers.  

The Cybersecurity Act is the Dutch implementation of the European NIS2 Directive and replaces the Network and Information Systems Security Act (Wbni). At the same time, the Critical Entities Resilience Act (Wwke) entered into force in the Netherlands. There is no gradual implementation. The obligations apply immediately.

Three core obligations

The law applies to organizations with 50 or more employees or more than 10 million euros in turnover in eighteen designated sectors, including energy, drinking water, transport, financial services, healthcare, digital infrastructure, and government. These organizations – and in specific cases also their supply chain partners – must check for themselves whether they fall under the law, and if so, Register in the entities register via MijnNCSC.

The law requires these organizations to take appropriate technical and organizational measures against cyber incidents, based on a risk assessment, and to report significant incidents to the competent CSIRT within 24 hours. This is supplemented by managerial responsibility. Directors must formally approve the security measures, oversee their implementation, and comply with a training obligation.

As Ziptone already outlined in June, the law is Highly relevant to the customer contact sectorIf the parent organization falls under the law, this also applies to all business units in specific cases, including customer service. Failure of a CRM or CCaaS platform or a data breach involving customer data can constitute a significant incident. The front office must therefore know what may be communicated to customers and when. This impacts the design of processes, procedures, knowledge bases, and training.

The Cybersecurity Act affects hundreds of contact centers

The Cybersecurity Act applies to approximately 8.100 Dutch entities. NCTV and NCSC only mention this. totalAlthough organizations must register, that register is not public.

• The law applies to all decentralized authorities. These include all 342 municipalities, the 21 water boards, and 12 provinces alone. The law also applies to all agencies and independent administrative bodies, including the country's largest public customer contact organizations: Belastingtelefoon, UWV, SVB, DUO, RDW, CBR, CJIB, IND, and Kadaster.
• The Cbw also affects larger hospital organizations, mental health care institutions, elderly care organizations, disability care, GP out-of-hours services, and large home care organizations.
• In the utilities sector, the law applies to drinking water companies such as Vitens, Brabant Water, Dunea, Evides, PWN, and WML, but also to regional grid operators (Liander, Enexis, Stedin, Coteq, Rendo, Westland Infra), TenneT, and Gasunie. In addition, the law applies to several dozen energy suppliers with consumer customers (Eneco, Vattenfall, Essent, Greenchoice, Budget Energie) and heat companies. The major telecom companies are also subject to the law.
• And finally, the transport sector is an important group, with many dozens of entities with passenger contact: NS, Arriva, Qbuzz, EBS, Transdev/Connexxion, GVB, RET, HTM, Schiphol, KLM and Transavia, TESO and other ferry services, as well as logistics players such as PostNL, DHL, DPD, GLS and UPS.

It will likely become clear in a few months which organizations have actually registered via MijnNCSC. On August 15, Computable reported that less than half of the eight to ten thousand organizations in the Netherlands subject to the Cybersecurity Act (Cbw) had registered yet. Yesterday evening, the counter stood at 2.942 registrations in the Cbw entity register, the NCSC indicated. Computable.

(Ziptone/Erik Bouwer)

Interesting article? Share it!